diff --git a/mantle/cmd/kola/options.go b/mantle/cmd/kola/options.go
index 183098cb22..fc57d6403d 100644
--- a/mantle/cmd/kola/options.go
+++ b/mantle/cmd/kola/options.go
@@ -57,6 +57,7 @@ func init() {
 	ss("debug-systemd-unit", []string{}, "full-unit-name.service to enable SYSTEMD_LOG_LEVEL=debug on. Can be specified multiple times.")
 	sv(&kola.Options.IgnitionVersion, "ignition-version", "", "Ignition version override: v2, v3")
 	ssv(&kola.BlacklistedTests, "blacklist-test", []string{}, "Test pattern to blacklist. Can be specified multiple times.")
+	bv(&kola.NoNet, "no-net", false, "Don't run tests that require an Internet connection")
 	ssv(&kola.Tags, "tag", []string{}, "Test tag to run. Can be specified multiple times.")
 	bv(&kola.Options.SSHOnTestFailure, "ssh-on-test-failure", false, "SSH into a machine when tests fail")
 	sv(&kola.Options.CosaWorkdir, "workdir", "", "coreos-assembler working directory")
diff --git a/mantle/kola/harness.go b/mantle/kola/harness.go
index 27a546531e..2cf1ab3a9a 100644
--- a/mantle/kola/harness.go
+++ b/mantle/kola/harness.go
@@ -83,6 +83,7 @@ var (
 
 	TestParallelism int    //glue var to set test parallelism from main
 	TAPFile         string // if not "", write TAP results here
+	NoNet           bool   // Disable tests requiring Internet
 
 	BlacklistedTests []string // tests which are blacklisted
 	Tags             []string // tags to be ran
@@ -242,11 +243,22 @@ func filterTests(tests map[string]*register.Test, patterns []string, pltfrm stri
 		checkPlatforms = append(checkPlatforms, "qemu")
 	}
 
-	var blacklisted bool
 	noPattern := hasString("*", patterns)
 	for name, t := range tests {
+		var noNetFiltered bool
+		var blacklisted bool
+		for _, flag := range t.Flags {
+			if flag == register.RequiresInternetAccess && NoNet {
+				noNetFiltered = true
+				break
+			}
+		}
+		if noNetFiltered {
+			plog.Debugf("Skipping test that requires network: %s", t.Name)
+			continue
+		}
+
 		// Drop anything which is blacklisted directly or by pattern
-		blacklisted = false
 		for _, bl := range BlacklistedTests {
 			match, err := filepath.Match(bl, t.Name)
 			if err != nil {